Threat Intelligence / Actor / APT37 (ScarCruft / Ruby Sleet / Velvet Chollima)

APT37 (ScarCruft / Ruby Sleet / Velvet Chollima)

Nation: North Korea · 1 tracked threat(s) · Categories: APT

Also known as: APT37, ScarCruft, Ruby Sleet, Velvet Chollima, InkySquid, Ricochet Chollima, Group123, TEMP.Reaper, Reaper

Tracked threats

APT37 Ruby Jumper Campaign — Air-Gapped Network Bridging via THUMBSBD USB Worm, RESTLEAF Zoho WorkDrive C2, SNAKEDROPPER Ruby 3.3.0 Runtime Hijack, FOOTWINE/BLUELIGHT Surveillance Backdoors — HIGH

Full actor intelligence — infrastructure, IOCs, detection coverage and operator fingerprints — is available via the Threadlinqs MCP server (Purple tier). View plans →

Threadlinqs Intelligence